nccgroup / blackboxprotobuf

Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers (protobuf) without the matching protobuf definition.
MIT License
480 stars 82 forks source link

b64 encoded protobuf and other issues/questions #13

Closed KernowSec closed 1 year ago

KernowSec commented 1 year ago

Hey,

Awesome Repo.

I have a few issues/questions so figured creating an issue would be the best way to open a line of comms. The gRPC data im trying to maniupulate is currently base64 encoded in the request and response bodys. The "protobuf" tab doesnt pick up anything, unless i add a line to the get_protobuf_data() method of:

return base64.b64decode(content[content_info.getBodyOffset():].tostring())

When i try to re-encode the edited json i just run into a plethora of issues, either encoding the whole request, or not encoding at all. I imagine a line similair to the one above but encoding needs to be added to the set_protobuf_data() function?

Sorry and thanks in advance.

rwinkelmaier-ncc commented 1 year ago

Hi,

No problem. If you implement a custom get_protobuf_data() call, then the set_protobuf_data() will need to be modified to get the data back to the format your application expects.

Right now, it's setup to expect set_protobuf_data() to return the output from buildHttpMessage (https://portswigger.net/burp/extender/api/burp/iextensionhelpers.html#buildHttpMessage-java.util.List-byte:A-). You should be able to grab the headers from content_info and base64 encode the protobuf data, and pass both to buildMessage. An example of how it normally generates the contents is at https://github.com/nccgroup/blackboxprotobuf/blob/3e28323428e77d470574c793fa517f4d4a5dfc5b/burp/blackboxprotobuf/burp/editor.py#L146-L147

Out of curiosity, does the payload have the 5 byte gRPC header (starting with 0x00 + encoded length) or is it just a base64 encoded protobuf? I took a stab at adding in automatic base64 handling a while ago, but had some issues and wasn't sure how common that setup would be. Shouldn't be too hard to get working if folks are running into that.

If that doesn't work, let me know and I can try to debug. If you have an example request that reproduces the issue, that would be useful for debugging.